Brexit and data protection: Laying the odds

Among other things, 2018 will go down in history as the year of panics over data protection. First, it was the GDPR and its impossible deadline for compliance. Now it is Brexit and the uncertainty as to what it will mean. The famous phrase "Brexit means Brexit" is as cryptic today as it was two years ago. But now, with six months to go for the U.K.'s scheduled departure from the European Union, the uncertainty of not knowing what Brexit will look like seems paralyzing. The outcome of the Brexit negotiations – aimed at settling the terms of the future relationship between the U.K. and the EU – defies prediction, yet the need to prepare for Brexit's aftermath is pressing.

For those with responsibility for data protection compliance in the U.K. and abroad the question is a simple one: What will be the impact of Brexit on my organisation and what do we need to do about it? The answer largely depends on what kind of Brexit we will end up with, so let's try and assess the chances of each possible scenario.

Scenario 1 – Soft Brexit (aka "The Chequers plan")

A soft Brexit would involve formally leaving the EU with the minimum possible impact, bearing in mind what is realistically and politically achievable. This is in fact what the U.K. government appears to be aiming for. In data protection terms, this would be a nirvana-like situation involving the continued unhindered exchange of personal data between the U.K. and the EU and the ability for the Information Commissioner's Office to participate in the "one stop shop" mechanism of regulatory oversight. Given the adoption of the GDPR as the U.K.'s own data protection framework, optimism in this respect would not be entirely ill-founded, but for this to happen the U.K. and the EU would need to find the same level of understanding across all political issues on the table.

Likelihood: 20%

Scenario 2 – Semi-soft Brexit

A more achievable outcome would be to agree a deal that does not give the ICO a formal role as part of the "one stop shop" mechanism, but focuses on ensuring the free flow of personal data between the EU and the U.K. This would require the European Commission to commit to granting an adequacy finding – assuming that the conditions are met – either at the point of exit or during the agreed transitional period at the latest. In practical terms, this would mean that U.K. organizations would continue to operate as safe recipients of EU data in exactly the same way they do today. This would also probably allow the ICO to continue to be involved in the binding corporate rules authorization process, which would be massively welcomed not only by multinational organizations seeking BCR approval but by other EU data protection authorities working in this area.

Likelihood: 40%

Scenario 3 – Semi-hard Brexit

If things get rocky and the political will is not there, we could see a cordial but terse Brexit process. In this situation, everyone would be technically playing by the book without much regard for the "special relationship" that the U.K. and the EU should be aiming to have. So the European Commission would treat the U.K. in a nominally neutral way, whilst the U.K. would need to seek adequacy in the knowledge that the level of scrutiny would be meticulous, to say the least. Adequacy would eventually be granted, but it would be unwise to expect any sort of fast-tracking. In practice, this would mean several years during which U.K. recipients of data from the EU would have to make up for the lack of adequacy by applying appropriate safeguards through contractual arrangements, BCR or similar legal tools.

Likelihood: 30%

Scenario 4 - Hard Brexit (aka "No deal Brexit")

Potentially, everything could go pear shaped. Judging by the way some hard-core Brexiteers continue to proclaim the virtues of a "no deal Brexit," this scenario would not only be possible but somewhat desirable. From a data protection compliance perspective, however, this would firmly close the door to any hopes of an EU adequacy finding or a role for the ICO among fellow data protection authorities. Political hostility would lead to a lack of understanding, which would even render an EU-U.K. Privacy Shield-type arrangement impossible. Given that in reality this is in no one's interest, this scenario seems unlikely but, if it happened, legitimizing international data flows would potentially be an uphill struggle for any U.K. organization seeking to do business with EU-based counterparts.

Likelihood: 10%

Taking all of this into account, it is obvious that undertaking some practical preparation is essential. Whatever the plan, it should be kept under review but, as a minimum, anyone seeking to address the impact of Brexit on data protection should be:

Assessing existing and future data transfers between the EU and the U.K.

Identifying suitable mechanisms to legitimise data transfers in the event of no EU adequacy finding for the U.K.

Considering alternative lead authorities to the ICO – both for the purposes of the "one stop shop" and new BCRs.

Keeping a close eye on the ongoing negotiations between the U.K. and the EU.

5 Comments

Hi Cormac,
We were not aware of the association. We appreciate you bringing it to our attention. We have changed out the photo and will not use it again.
Sam Pfeifle, Content Director

comment
Wim Snellaars • Oct 3, 2018

In my humble opinion, there is also a fifth scenario possible, although highly unlikely. NO BREXIT.

comment
Ian Garratt • Oct 15, 2018

Likelihood of alternative mechanisms:
Contractual arrangements - 50% ( a lot of larger firms will use these already for non-EU partners)
Consent - 20% (automatic fall back / panic position. See marketing consents and privacy notices pre-GDPR)
BCR - 10% (whether used correctly or not)
"One-off" or "Public interest" - 5% (" " because whether the transfers are truely one-off or in the public interest will be debatable; will be used short term until adequacy / privacy shield is in place)
No safeguard or other derogation - 15% (no safeguards)

comment
Andor Demarteau • Nov 28, 2018

Scenario 1: unrealistic as it does not cover services and only goods. So the scenario as portrait here doesn't really exists.
Scenario's 2 and 3 are unlikely in the current post-deal and current UK parlement situation.
Scenario 4: 75%.
Scenario 5: no brexit or EEA (European Economic Area) membership, 25% or maybe even lower.
Anything in between scenario's 4 and 5 will require an adequacy decision, which may become problematic considering the IPA (Investegatory Powers Act or snoopers charter).
All scenario's 1-4 will have the ICO outside the one-stop-shop mechanism as the UK is outside the single market and doesn't want to be bound by the ECJ neither so I don't see anything close to what is suggested here happening in those situations.

Related Stories

No doubt these are busy times for privacy practitioners, but they're not the only ones who've been immersed in work since May 25. That was clear Wednesday when two EU-based data protection regulators shared insight with IAPP Europe Managing Director Paul Jordan and a packed room here at the IAPP Dat...

As the opening act for the sold-out Data Protection Intensive here in London today, U.K. Information Commissioner Elizabeth Denham set to rest some of the common misconceptions she knows privacy professionals are losing sleep over as the countdown to the General Data Protection Regulation slinks nea...

Reaction continues Monday to news over the weekend that data analytics firm Cambridge Analytica used, and allegedly did not delete as agreed, what may have been personal information of 50 million Facebook users. The effects of the incident may have far reaching implications for Facebook and how peop...

Twice now — first at a speech focused on security, in Munich, then this past Friday in her so-called "Five Tests" speech detailing her goals for Brexit — U.K. Prime Minister Theresa May has outlined her desire for a data protection agreement with the EU. To quote from her fourth test in Friday's spe...

I know you're thinking: "What does Brexit have to do with ePrivacy?" Well, let me lay out a little scenario for you.
First, you've got the issue of what's going to happen with the U.K.'s 73 seats in the European Parliament when Brexit goes final at 11 p.m. on March 29, 2019. In a provisional vote l...

The IAPP is the largest and most comprehensive global information privacy community and resource. Founded in 2000, the IAPP is a not-for-profit organization that helps define, support and improve the privacy profession globally.

The IAPP is the only place you’ll find a comprehensive body of resources, knowledge and experts to help you navigate the complex landscape of today’s data-driven world. We offer individual, corporate and group memberships, and all members have access to an extensive array of benefits.